Guest User

Untitled

a guest
Aug 23rd, 2019
76
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. server {
  2. # listen 158.58.135.131:80;
  3. listen 158.58.135.131:443;
  4. server_name lk.red-net.net www.lk.red-net.net;
  5. ssl on;
  6. ssl_certificate /etc/letsencrypt/live/red-net.net/fullchain.pem;
  7. ssl_certificate_key /etc/letsencrypt/live/red-net.net/privkey.pem;
  8. # ssl_certificate /etc/nginx/cert/fullchain.pem;
  9. # ssl_certificate_key /etc/nginx/cert/privkey.pem;
  10. ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  11. ssl_prefer_server_ciphers on;
  12. ssl_dhparam /etc/nginx/cert/dhparam.pem;
  13. ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
  14. ssl_session_timeout 1d;
  15. ssl_session_cache shared:SSL:50m;
  16. ssl_stapling on;
  17. ssl_stapling_verify on;
  18. add_header Strict-Transport-Security max-age=15768000;
  19. access_log /var/log/nginx/ssl.lk.red-net.access.log;
  20. error_log /var/log/nginx/ssl.lk.red-net.error.log;
  21. if ($request_method !~ ^(GET|HEAD|POST)$ ) {
  22. return 444;
  23. }
  24. if ( $http_referer ~* (babes|forsale|girl|jewelry|love|nudit|organic|poker|porn|sex|teen|masscan|scan) ){
  25. return 403;
  26. }
  27. location / {
  28. # allow 10.0.0.0/8;
  29. ## allow 158.58.135.128/27;
  30. # allow 93.190.16.0/21;
  31. # allow 109.235.184.0/21;
  32. # allow 185.30.116.0/22;
  33. # allow 158.58.128.0/21;
  34. # deny all;
  35. if ($host !~ ^(lk.red-net.net|www.lk.red-net.net)$ ) {
  36. return 444;
  37. }
  38. # proxy_pass http://10.32.255.4:80;
  39. proxy_pass https://10.32.255.4:443/lbweb-client/$request_uri;
  40. proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  41. proxy_set_header Host $http_host;
  42. }
  43. }
RAW Paste Data